Privacy notice

The main way we collect your personal information is when you provide it directly to us during the registration process to become an RCOT member.

We also receive your Unison number and your local Unison branch from Unison.

As a member, we may collect further information about you depending on the services you use and how you engage with us (including as a volunteer). For example if you use choose to use our advisory line or take part in research.

For non-members, we collect limited personal information about you when you provide it directly to us, for example if you sign up to attend one of our events or sign up to use our website.,

Our website uses essential cookies, along with a limited number of site performance and advertising cookies to give you the best experience on our website. We also use cookies to recognise users, and authenticate your membership. We give you a clear opportunity to accept non-essential cookies or not, and you can change your preferences at any time.

To find out more about the cookies and similar technologies we deploy and how to update your cookie preferences, please select the cookie icon on our website.      

The types of personal information we collect and hold about you depends on the nature of your relationship with us. Routinely this includes some, or all of the following:

• Full name, residential address, landline and mobile phone number, email address, date of birth, HCPC number, professional status, workplace information, bank details/credit card details.

We should stress there is specific mandatory information collected during the membership registration process, which is necessary for you to be approved as an RCOT member. If you do not wish to provide this information, we will need to decline your membership request.

Additional information may be collected about you if you take part in research  or use our advisory services or CPD platform.    

Under data protection law certain information about you is awarded special protection, this includes information about your health, ethnic/racial origin and sexual orientation. This is commonly referred to as Special Category Data.  Routinely we collect this type of information in the following ways:

• Diversity information about our members
• Health information disclosed via our advisory line  
• Dietary/disability requirements provided by you when attending one of our events. (This is only used for the purpose of facilitating your attendance).  

We never force you to provide this information, it is always your choice.  We request your explicit consent   to handle this information and you can withdraw your consent at any time. For more information contact our Data Protection Officer: gdpr@rcot.co.uk.

If you are a member this will include the following purposes, where relevant for you:  

• to facilitate your participation in:

1. RCOT communities
2. our professional advisory service
3. events
4. professional development activity
5. or other services that are a core part of your RCOT membership.

• to contact you with membership updates and information
• to contact you and invite you to take part in research or evaluation activities
• to respond to any membership (or other queries) you may have
• to improve our membership support  
• to support your access to our advisory line  
• for internal training purposes, market research and analytical purposes          
• to carry out routine record keeping and administrative tasks
• to handle complaints and disputes
• to comply with any legal obligations If you are not a member of RCOT, we will use your information to facilitate your access and use of non-member services, such as events or access to information on our website.

Under data protection law, we need to make sure we have a lawful basis for our activities involving personal information. Set out below are the lawful basis we rely on and examples of when we rely on this basis.

Contract

We rely on the lawful basis of performance of a contract to provide you with our products and services. For example, as a RCOT member you sign up to our T&Cs and we have a duty to fulfil our contractual obligations to you.   This lawful basis also covers any steps necessary before entering a contract. For example, personal information we may collect in relation to initial membership enquiries and during the membership application process.

Consent

Sometimes, we will ask for your consent to use your personal information for a specific purpose. This will always be clearly brought to your attention, and you will have the choice to actively agree or not. As an example, we request your consent to take part in research activities. You have the right to withdraw your consent at any time and can do so by contacting our Data Protection Officer: gdpr@rcot.co.uk.

Legitimate Interests

We use the lawful basis of legitimate interests, in circumstances where we have balanced our organisations interests with your interests. Where we believe our activities are within your reasonable expectations and don’t have a negative impact on you. We rely on legitimate interests for the following purposes:

• to send you membership communications
• to improve our membership support
• for training purposes, market research and analytics
• to carry out routine record keeping and administrative tasks  

Legal obligation

There will be circumstances in which RCOT is legally obliged to undertake certain activities to comply with the applicable laws.

Other lawful bases

In limited circumstances we may rely on the lawful basis of public task, this would be where we can demonstrate our activities are in the public interest. In exceptional circumstances we would rely on the lawful basis of vital interests. For example, in a medical emergency, if you’re not capable of giving your consent.

We share your personal information with partner organisations and with our suppliers, who support us in delivering our products and services.

Partner organisations

• Unison  – All eligible members receive Unison support as part of their membership. (see Unison’s Privacy Policy for how they handle your personal information)
• World Federation of Occupational Therapists (WFOT) – We share your personal details with WFOT if you wish to register for WFOT Individual Membership (see WFOT’s Privacy Policy for how they handle your personal information).

Our service providers  

We use external service providers to support the efficient running of our organisation. These external companies handle your personal information on our behalf, and we have appropriate contractual arrangements in place with them. They only have access to the personal information necessary for the service they provide.

The services provided to us include website hosting, survey tools, election and AGM voting, and facilitation and delivery of events either in person or digitally, community engagement, continuous professional development, research and innovation, email communications and delivery of other member benefit or services.

Our service providers are routinely located in the UK or within the European Economic Area.  Where a service provider is located outside the UK/EEA we make sure necessary contractual measures are in place to protect your personal information. These include: an adequacy decision, EU Standard Contractual Clauses with the UK Addendum.    

If you would like further information about international data transfers, please contact our Data Protection Officer: gdpr@rcot.co.uk

Public bodies, law enforcement agencies and regulators

The Police and other law enforcement agencies, as well as public bodies such as local and central authorities can sometimes request personal information. This may be for the purposes of preventing or detecting crime, apprehending or prosecuting offenders, assessing or collecting tax, investigating complaints or assessing how well a particular industry sector is working. We assess such requests on a case-by-case basis and would only disclose personal data where we judge we had a strong justification for doing so.   

You have a number of rights under UK data protection law. These are listed below, along with our contact details, should you wish to make a request.

• Informed: You have the right to be informed about how we handle your personal data.  This privacy statement is one of the ways we fulfil this right. It should tell you everything you need to know, but you can always contact use to find out more or to ask any questions.
• Access: You have the right to ask us for a copy of the personal data we hold about you, the purposes for which we are using it and to check we are handling it lawfully. ‘Personal data’ is any information which can directly, or indirectly, identify you.
• Rectification: You have the right to ask us to change any details which are incorrect or need updating. We would always encourage you to let us know if your details have changed.
• Erasure: You have the right to ask us to delete your personal information. This is not an absolute right, and in certain circumstances we may have justifiable reasons for declining your request.
• Consent: Where we have collected your consent to use your personal details for a specified purpose(s) you can withdraw your consent at any time.  

You also have the right to request we restrict or suppress your personal data, and the right to data portability. If you’d like to exercise any your privacy rights, please contact our Data Protection Officer. Please note we may need to request proof of your identity in order to fulfil certain requests.

Email: gdpr@rcot.co.uk
Post: Data Protection Officer, Royal College of  Occupational Therapists, 106-114 Borough High Street, Southwark, London SE1 1LB

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves however, so please contact us first.  

We will endeavour not keep your personal information for any longer than is necessary for the purposes it is collected and used for. This is in line with the retention schedule set out in our data retention and destruction policy.  

We need to retain personal information to comply with our legal obligations, resolve any disputes and enforce our rights. These reasons can vary from one piece of information to the next and depend on our relationship with you.

In all cases, our need to keep your personal information will be reassessed on a regular basis, and information which is no longer required for any purposes will be deleted/disposed of securely. Your membership contact information is held for as long as you continue to use our services – after you end your membership we will retain your name, address and the dates you become a member and stopped being a member for a period of ten years, as required by company law. All other member data will be deleted seven years from the closure of your membership.  

Please remember if you use a link to go from our website to another website, this Privacy Notice will no longer apply once you have left our website. Your browsing and interaction on any other website is subject to that website’s own rules and policies.